

Page 32, replace the paragr aph beginning at line 3 with the following paragraph: 
According to the crypto processing apparatus of this embodiment, an LSI having 
abundant functions capable of handling the finite field GF(2'^m) based elliptic curve 
cryptosystem as well as the integer based RAS RSA system can be provided as a 
crypto processing coprocessor without specifically increasing the packing area. An 
encryption/decryption apparatus capable of handling both RAS RSA and elliptic curve 
cryptosystem can be implemented in even an apparatus having a small packing area, 
such as an IC card. 



Page 35, re^ace the paragraph beginning at line 12, with the following 

paragraph: , 

In this embodiment, the full adder shown in FIG. 5 is used as the full adder 42 
having the carry control function. However, the full adder 43 or 44 having a carry 
control function shown in FIG. 6 or 7 may be used ift stea4 instead of the full adder 42 
having a carry control function. 

Page 35, replajeJe^^ beginning at line 24, with the following 
paragraph: 

This embodiment is a concrete example of the modulo section of the first 
embodiment. As shown in FIG. 10, a controller unit 5 includes a finite field GF(2'^m) 
arithmetic controller 22a 22 having a modulo function added to the above function, and 
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a quotient acquisition circuit 50 which is controlled by the modulo function and has an 



Page 36, rejgflace the paragraph beginning at line 4, with the following paragraph: 
In this case, in addition to the above function of controlling an arithmetic unit 4 to 
obtain a multiply result of c'(x) of equation (5), the finite field GF(2'^m) arithmetic 
controller 22a 22 has the function of controlling the arithmetic unit 4 and quotient 
acquisition circuit 50 to execute a modulo for this multiply result c'{x) using a modulo 
polynomial f(x). More specifically, the control function includes the function of 
inputting/outputting data to/from a memory 2 and buffers 17X, 17Y, 17Z, and 17R on the 
basis of the operation algorithm to be described later, and the function o generating 
various commands such as a multiply command, addition command, and inverse 
operation command and supplying them to corresponding arithmetic circuits in 
accordance with the input/output operation. 



Page 36, re^ce the paragraph beginning at line 37, with the following 
paragraph: 

More specifically, the quotient acquisition circuit 50 is controlled by the finite field 
GF(2'^m) arithmetic controller 22a 22, and has the function of supplying the upper two 
blocks (Fl.i(x), Fl.2(x)) of the modulo polynomial f(x) in the memory 2 to the inverse 
calculator section 51 in only one time of the modulo and making the section 51 calculate 
the inverse |3(x) of the upper two blocks, the function of reading out the obtained inverse 
p(x) from the memory 2 when the inverse is written in the memory 2, the function of 



inverse calculator section 51 . 





obtaining a quotient y(x) by multiplying the readout inverse |3(x) and the upper two 
blocks (C'l-i(x) . C'l.2(x) ) of the current dividend polynomial, the function of setting the 
obtained quotient y(x) as a quotient qi(x) of the upper two blocks and writing the 
quotient qi(x) in the memory 2, and the function of repeating the operation from reading 
out the inverse p(x) to writing the quotient qi(x) until a residue c(x) is obtained, as shown 
in FIG. 11. 



Page 41, rep^e the paragraph beginning at line 20, with the following 

paragra ph: ^ 

After setting the upper two blocks (Fl-kx), Fl:2(x)) as a divisor in a coefficient unit 
93 in FIG. 27, the inverse calculator section 51 inputs the dividend x^ to the shift 
register from higher orders and repeats a shift in units of clocks 2*16 times, thereby 
obtaining a 32-bit inverse a(x). Note that one block may consist of 8 or 32 bits or 
another arbitrary number of bits. In such a case as well, the inverse a(x) can be 
calculated by the same scheme. 




